[PATCH 50/50] drm: use memdup_user() as a cleanup

[Daniel Vetter]

From: Dan Carpenter <dan.carpenter at oracle.com>

drivers/gpu/drm/r128/r128_state.c:1014:10-17: WARNING opportunity for memdup_user
/c/kernel-tests/src/cocci/drivers/gpu/drm/r128/r128_state.c:1029:9-16: WARNING opportunity for memdup_user
/c/kernel-tests/src/cocci/drivers/gpu/drm/r128/r128_state.c:904:10-17: WARNING opportunity for memdup_user
/c/kernel-tests/src/cocci/drivers/gpu/drm/r128/r128_state.c:914:9-16: WARNING opportunity for memdup_user

 Use memdup_user rather than duplicating its implementation
 This is a little bit restricted to reduce false positives

Generated by: coccinelle/api/memdup_user.cocci

CC: Daniel Vetter <daniel.vetter at ffwll.ch>
Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
Signed-off-by: Daniel Vetter <daniel.vetter at ffwll.ch>
---
 drivers/gpu/drm/r128/r128_state.c | 46 ++++++++++-----------------------------
 1 file changed, 12 insertions(+), 34 deletions(-)

diff --git a/drivers/gpu/drm/r128/r128_state.c b/drivers/gpu/drm/r128/r128_state.c
index 22a5545c5f49..97064dd434c2 100644
--- a/drivers/gpu/drm/r128/r128_state.c
+++ b/drivers/gpu/drm/r128/r128_state.c
@@ -901,25 +901,16 @@ static int r128_cce_dispatch_write_span(struct drm_device *dev,
 		return -EFAULT;
 
 	buffer_size = depth->n * sizeof(u32);
-	buffer = kmalloc(buffer_size, GFP_KERNEL);
-	if (buffer == NULL)
-		return -ENOMEM;
-	if (copy_from_user(buffer, depth->buffer, buffer_size)) {
-		kfree(buffer);
-		return -EFAULT;
-	}
+	buffer = memdup_user(depth->buffer, buffer_size);
+	if (IS_ERR(buffer))
+		return PTR_ERR(buffer);
 
 	mask_size = depth->n * sizeof(u8);
 	if (depth->mask) {
-		mask = kmalloc(mask_size, GFP_KERNEL);
-		if (mask == NULL) {
+		mask = memdup_user(depth->mask, mask_size);
+		if (IS_ERR(mask)) {
 			kfree(buffer);
-			return -ENOMEM;
-		}
-		if (copy_from_user(mask, depth->mask, mask_size)) {
-			kfree(buffer);
-			kfree(mask);
-			return -EFAULT;
+			return PTR_ERR(mask);
 		}
 
 		for (i = 0; i < count; i++, x++) {
@@ -1011,34 +1002,21 @@ static int r128_cce_dispatch_write_pixels(struct drm_device *dev,
 	}
 
 	buffer_size = depth->n * sizeof(u32);
-	buffer = kmalloc(buffer_size, GFP_KERNEL);
-	if (buffer == NULL) {
-		kfree(x);
-		kfree(y);
-		return -ENOMEM;
-	}
-	if (copy_from_user(buffer, depth->buffer, buffer_size)) {
+	buffer = memdup_user(depth->buffer, buffer_size);
+	if (IS_ERR(buffer)) {
 		kfree(x);
 		kfree(y);
-		kfree(buffer);
-		return -EFAULT;
+		return PTR_ERR(buffer);
 	}
 
 	if (depth->mask) {
 		mask_size = depth->n * sizeof(u8);
-		mask = kmalloc(mask_size, GFP_KERNEL);
-		if (mask == NULL) {
-			kfree(x);
-			kfree(y);
-			kfree(buffer);
-			return -ENOMEM;
-		}
-		if (copy_from_user(mask, depth->mask, mask_size)) {
+		mask = memdup_user(depth->mask, mask_size);
+		if (IS_ERR(mask)) {
 			kfree(x);
 			kfree(y);
 			kfree(buffer);
-			kfree(mask);
-			return -EFAULT;
+			return PTR_ERR(mask);
 		}
 
 		for (i = 0; i < count; i++) {
-- 
1.8.4.3